aws-s3-checksum-null.php

#!/usr/bin/env php
<?php

require __DIR__ . '/vendor/autoload.php';

use Aws\S3\S3Client;

$s3 = new S3Client([
    'version' => 'latest',
    'endpoint' => 'https://s3.eu-central-1.amazonaws.com',
    'region'  => 'eu-central-1',
    'use_path_style_endpoint' => false,
    'credentials' => [
        'key' => getenv('AWS_ACCESS_KEY_ID'),
        'secret' => getenv('AWS_SECRET_ACCESS_KEY'),
    ],
]);
$bucket = getenv('BUCKET');
$key = 'test.txt';

function signUpload($s3, $bucket, $key, $file) {
    $hash = hash_file('sha256', $file, true);
    $hash = base64_encode($hash);

    echo "[+] Generating presigned request...\n";
    $command = $s3->getCommand('PutObject', [
        'Bucket' => $bucket,
        'Key' => $key,
        'ChecksumAlgorithm' => 'SHA256',
        'ChecksumSHA256' => $hash,
    ]);
    $presignedRequest = $s3->createPresignedRequest($command, '+10 minutes');
    return (string) $presignedRequest->getUri();
}

function uploadS3($s3, $bucket, $key, $hashFile, $uploadFile) {
    $hash = hash_file('sha256', $hashFile, true);
    $hash = base64_encode($hash);

    echo "[+] Uploading file with hash...\n";
    $command = $s3->getCommand('PutObject', [
        'Bucket' => $bucket,
        'Key' => $key,
        'SourceFile' => $uploadFile,
        'ChecksumAlgorithm' => 'SHA256',
        'ChecksumSHA256' => $hash,
    ]);
    try {
        $result = $s3->execute($command);
        echo "$result\n";
    } catch (Exception $e) {
        echo "{$e->getMessage()}\n";
    }
}

function uploadFilePresigned($url, $file) {
    echo "[+] Uploading to $url\n";
    // yolo, don't do this in real life
    system("curl -T '$file' '$url'");
}

function downloadFile($s3, $bucket, $key) {
    echo "[+] Testing content...\n";
    $command = $s3->getCommand('GetObject', [
        'Bucket' => $bucket,
        'Key' => $key,
    ]);
    try {
        $result = $s3->execute($command);
        $body = $result->get('Body');
        $body->rewind();
        echo("$body\n");
    } catch (Exception $e) {
        echo "{$e->getMessage()}\n";
    }
}

echo "[+] Testing legitimate upload (sdk)\n";
uploadS3($s3, $bucket, $key, '/etc/issue', '/etc/issue'); // upload the same file, this works and checksum is set on object
downloadFile($s3, $bucket, $key);

echo "[+] Testing incorrect content upload (sdk)\n";
uploadS3($s3, $bucket, $key, '/etc/issue', '/etc/timezone'); // upload a different file, this fails
downloadFile($s3, $bucket, $key);

echo "[+] Testing legitimate upload (presigned)\n";
$url = signUpload($s3, $bucket, $key, '/etc/issue');
uploadFilePresigned($url, '/etc/issue'); // upload the same file, this works but no checksum is set on object
downloadFile($s3, $bucket, $key);

echo "[+] Testing incorrect content upload (presigned)\n";
$url = signUpload($s3, $bucket, $key, '/etc/issue');
uploadFilePresigned($url, '/etc/timezone'); // upload a different file, this should fail
downloadFile($s3, $bucket, $key);